Messages in this thread | | | Subject | Re: [PATCH 1/1] tcp: Wrong timeout for SYN segments | From | Eric Dumazet <> | Date | Wed, 29 Aug 2012 01:51:45 -0700 |
| |
On Tue, 2012-08-28 at 21:34 -0700, H.K. Jerry Chu wrote:
> IMHO 31secs seem a little short. Why not change it to 6 as well because 63 > secs still beats 93secs with 3sec initRTO and 5 retries. > > Jerry >
My rationale was that such increase were going to amplify SYN attacks impact by 20% (if we count number of useless SYNACK sent)
If the active side sends SYN packets for 180 seconds, do we really want to also send SYNACKS for additional 100 seconds ?
Sure, RFC numbers are what they are, but in practice, I doubt someone will really miss the extra SYNACK sent after ~32 seconds, since it would matter only for the last SYN attempted.
| |